header-logo header-logo

Morrisons wins vicarious liability case

31 March 2020
Categories: Legal News , Employment , Data protection
printer mail-detail
A supermarket was not vicariously liable for the actions of an employee who was ‘pursuing a personal vendetta’, the Supreme Court has ruled unanimously in a landmark judgment

In November 2013, Andrew Skelton, an employee at Morrisons supermarket, downloaded payroll data he was entrusted with at work onto a personal USB stick and took it home. He later uploaded the data onto a file-sharing website and sent it to newspapers, pretending to be a concerned member of public who had found it online.

More than 5,500 employees whose personal data was disclosed sought damages from Morrisons.

The Justices considered whether vicarious liability can apply to a Data Protection Act 1988 breach, and whether breach occurred in the course of Skelton’s employment, in WM Morrison Supermarkets v Various Claimants [2020] UKSC 12.

Lord Reed, giving the judgment, found that vicarious liability can apply to a data protection breach under common law, but that the employer had no liability in this case.

Claire Greaney, senior associate, Charles Russell Speechlys said: ‘Today’s decision is welcome news for businesses, confirming that they will not be vicariously liable for breaches of this nature.

Going forward, in these “rogue employee” cases the focus will be on what the data controller has or hasn’t done to prevent the breach for occurring.  Courts will be looking at whether the data security principle of the GDPR has been breached. This requires data controllers to ensure appropriate security of personal data, which will be different for every company. Conducting data protection impact assessments will be critical to demonstrating compliance.

However, it wasn’t all good news for businesses today. The Court did not say there could never be vicarious liability for the conduct of employees in the world of data protection. If the door to vicarious liability was left ajar by the Court of Appeal, the Supreme Court has confirmed that it is staying open. In the GDPR era of mandatory notification businesses will need to look carefully at the measures they take to mitigate these risks, including taking out data insurance to protect themselves.’

Susan Hall, data protection partner, Clarke Willmott, said: ‘It’s very much the judgement all employers must have hoped the Supreme Court would reach; a common sense restatement of the law of vicarious liability which allows it to be properly applied in relevant cases where the employee has acted improperly within the scope of their duties (including where the employee is a data controller of data) but has not gone completely off piste.’

Employment barrister Mark Thomas, of 5 Essex Court, said: ‘The Supreme Court have reversed [the Court of Appeal's] decision, restoring normality to the previously established position on vicarious liability. Morrisons has been saved by the Supreme Court’s recognition that “it is abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier”.

‘This case also has wider implications for employers through the country. It means that, if they adopt conscientious and careful data control and protection measures, then they can be relatively sure that they are protected against the legal consequences of vindictive data breaches.’

MOVERS & SHAKERS

NLJ Career Profile: Maria Karaiskos KC, Church Court Chambers

NLJ Career Profile: Maria Karaiskos KC, Church Court Chambers

Maria Karaiskos KC, recently appointed as the first female head of Church Court Chambers, discusses breaking down barriers, the lure of the courtroom, and the power of storytelling

Cripps—Simon Main

Cripps—Simon Main

Firm strengthens residential property team with partner hire

Hugh James—Danielle Cahill

Hugh James—Danielle Cahill

Private wealth disputes team welcomes partner in London

NEWS
In a very special tribute in this week's NLJ, David Burrows reflects on the retirement of Patrick Allen, co-founder of Hodge Jones & Allen, whose career epitomised the heyday of legal aid
Writing in NLJ this week, Kelvin Rutledge KC of Cornerstone Barristers and Genevieve Screeche-Powell of Field Court Chambers examine the Court of Appeal’s rejection of a discrimination challenge to Tower Hamlets’ housing database
Michael Zander KC, Emeritus Professor at LSE, tracks the turbulent passage of the Terminally Ill Adults (End of Life) Bill through the House of Lords in this week's issue of NLJ. Two marathon debates drew contributions from nearly 200 peers, split between support, opposition and conditional approval
Alistair Mills of Landmark Chambers reflects on the Human Rights Act 1998 a quarter-century after it came into force, in this week's issue of NLJ
In his latest Civil Way column for NLJ, Stephen Gold surveys a raft of procedural changes and quirky disputes shaping civil practice. His message is clear: civil practitioners must brace for continual tweaks, unexpected contentions and rising costs in everyday litigation
back-to-top-scroll